marcan changed the topic of #asahi-gpu to: Asahi Linux: porting Linux to Apple Silicon macs | GPU / 3D graphics stack black-box RE and development (NO binary reversing) | Keep things on topic | GitHub: https://alx.sh/g | Wiki: https://alx.sh/w | Logs: https://alx.sh/l/asahi-gpu
JusticeE1 has quit [Ping timeout: 244 seconds]
JusticeE1 has quit [Ping timeout: 244 seconds]
JusticeE1 has quit [Ping timeout: 244 seconds]
mxw39 has joined #asahi-gpu
mxw39 has joined #asahi-gpu
mxw39 has joined #asahi-gpu
g3rp has joined #asahi-gpu
g3rp has joined #asahi-gpu
g3rp has joined #asahi-gpu
g3rp has quit [Client Quit]
g3rp has quit [Client Quit]
g3rp has quit [Client Quit]
DragoonAethis has quit [Quit: hej-hej!]
DragoonAethis has quit [Quit: hej-hej!]
DragoonAethis has quit [Quit: hej-hej!]
DragoonAethis has joined #asahi-gpu
DragoonAethis has joined #asahi-gpu
DragoonAethis has joined #asahi-gpu
JusticeEX has joined #asahi-gpu
JusticeEX has joined #asahi-gpu
JusticeEX has joined #asahi-gpu
mxw39 has quit [Quit: Konversation terminated!]
mxw39 has quit [Quit: Konversation terminated!]
mxw39 has quit [Quit: Konversation terminated!]
mxw39 has joined #asahi-gpu
mxw39 has joined #asahi-gpu
mxw39 has joined #asahi-gpu
mxw39 has quit [Client Quit]
mxw39 has quit [Client Quit]
mxw39 has quit [Client Quit]
mxw39 has joined #asahi-gpu
mxw39 has joined #asahi-gpu
mxw39 has joined #asahi-gpu
odmir has quit [Remote host closed the connection]
odmir has quit [Remote host closed the connection]
odmir has quit [Remote host closed the connection]
_whitelogger_ has quit [Remote host closed the connection]
_whitelogger__ has quit [Remote host closed the connection]
PhilippvK has joined #asahi-gpu
phiologe has quit [Ping timeout: 260 seconds]
mrkajetanp has joined #asahi-gpu
mrkajetanp has quit [Client Quit]
mxw39 has quit [Quit: Konversation terminated!]
mxw39 has joined #asahi-gpu
mxw39 has quit [Quit: Konversation terminated!]
tbodt_ has quit [Quit: ZNC 1.6.6+deb1ubuntu0.2 - http://znc.in]
tbodt has joined #asahi-gpu
AlJaMa has quit [Quit: No Ping reply in 180 seconds.]
AlJaMa has joined #asahi-gpu
AlJaMa has joined #asahi-gpu
AlJaMa has quit [Changing host]
linkmauve has joined #asahi-gpu
Necrosporus has quit [Read error: Connection reset by peer]
Necrosporus has joined #asahi-gpu
JusticeE1 has joined #asahi-gpu
JusticeEX has quit [*.net *.split]
thestr4ng3r has quit [Ping timeout: 256 seconds]
thestr4ng3r has joined #asahi-gpu
g3rp has joined #asahi-gpu
user1tt[m] has joined #asahi-gpu
zkrx has quit [Ping timeout: 256 seconds]
zkrx has joined #asahi-gpu
Necrosporus_ has joined #asahi-gpu
Necrosporus is now known as Guest12169
g3rp has quit [Quit: Lost terminal]
JusticeE1 has quit [Ping timeout: 264 seconds]
JusticeEX has joined #asahi-gpu
hypergenesis[m] has quit [Quit: Idle for 30+ days]
theracermaster has quit [Quit: Ping timeout (120 seconds)]
theracermaster has joined #asahi-gpu
jaalsa has quit [Quit: jaalsa]
jaalsa has joined #asahi-gpu
odmir has joined #asahi-gpu
g3rp has joined #asahi-gpu
hypergenesis[m] has joined #asahi-gpu
DarkShadow4444 has joined #asahi-gpu
<DarkShadow4444>
Hello there, I don't have a lot experience in GPU development, but I'd be interested in helping your reverse engineering efforts.
<DarkShadow4444>
I've got background in blackbox RE and development though (wine), tips on how I would get started contributing? Small first tasks for something like that?
<jn__>
bloom: ^
<chrisf>
dougall: any chance you could fill out the device_load etc docs a bit more? there's clearly a bunch of stuff rattling around in your head only, about typed loads etc
<DarkShadow4444>
chrisf: Yeah I found that site as well, though I didn't read through all the operands. Does the author work with asahi as well?
<chrisf>
DarkShadow4444: one big area of useful things would be to help dougall flesh out the missing pieces
<chrisf>
author is here in the channel :)
<chrisf>
have you got an M1 to poke at?
<DarkShadow4444>
I should be getting it soon
g3rp has quit [Remote host closed the connection]
<chrisf>
we also need to reverse the bulk of the command stream structures. `demo` in the gpu repo has a lot of mysterious stuff in it still
<DarkShadow4444>
Is there a process on how these known instructions are found out?
<DarkShadow4444>
Just compiling shaders and looking what the binary result is?
<chrisf>
pretty much. dougall has some other tricks, but ^ works.
<morelightning[m]>
I have an M1 and know the surface of Metal really well, but I don't know much about how to go about figuring out the command stream either. What tools are you guys using to look at it?
<morelightning[m]>
(And can we do it on the Mac OS side first by replacing the kext or something? I feel like doing it directly in linux would be unwieldy.
<chrisf>
morelightning[m]: everything so far is done by intercepting between the userspace driver (which does the "metal" stuff) and the kext
<DarkShadow4444>
chrisf: That should give most bit structures, but how to find out what the instructions actually do without running them?
<chrisf>
you run them :)
<morelightning[m]>
Do you mean the intercepting is done inside Mac OS then? Where is that toolset at?
<DarkShadow4444>
ah I found the object code sample ^^good, since I don't know metal myself (yet)
<chrisf>
morelightning[m]: all inside mac os
odmir_ has joined #asahi-gpu
odmir has quit [Read error: Connection reset by peer]
<morelightning[m]>
I skimmed through Alyssa's code on github briefly, but maybe I missed that part, unless thats part of the wrapper thing. It wasn't so clear whether it was to run on the Mac or linux.
<chrisf>
the wrapper intercepts the IOKit calls to the kernel driver
<morelightning[m]>
OH okay. So we are saying all the calls are eventually going through IOKit?
<chrisf>
yes, and there's only a few -- of the "allocate some memory", "execute this command buffer in memory", variety
<chrisf>
everything interesting is done in userspace, and you can get underneath it
<morelightning[m]>
Well that makes me feel a lot better 😂
<chrisf>
it's really not too unpleasant
<chrisf>
i mean, you have to run macos ;)
<chrisf>
but it's given up its secrets fairly readily so far
theracermaster5 has joined #asahi-gpu
<chrisf>
bloom, dougall jump in any time eh :)
<DarkShadow4444>
How exaclty do I have to understand "D = ALUDst(Dx:D, Dt)" and "D.broadcast_to_active(imm32)" ?
<DarkShadow4444>
I assume for Dx = 100 and D = 1 and Dt = 10 we get 32bit Register number (4 >> 1) and then?
<chrisf>
im only half paying attention
<morelightning[m]>
I guess I had this incorrect notion, that if we replaced metal, without replacing the kext, there would be interference conflict. But it sounds like, that's not the case.
<chrisf>
that sounds correct -- and the Dt field is cache control
<DarkShadow4444>
alrighty then. Sounds like something I could help with. Kinda familar to the last time I reverse engineered a MS binary blob
<DarkShadow4444>
probably gonna need to play around with it quite a bit before I can do anything productive though
odmir_ has quit [*.net *.split]
theracermaster has quit [*.net *.split]
theracermaster5 is now known as theracermaster
odmir has joined #asahi-gpu
g3rp has joined #asahi-gpu
<chrisf>
DarkShadow4444: note the topic
<morelightning[m]>
I got the interceptor running, though it crashed, I guess I'll try a simpler metal project
<chrisf>
DarkShadow4444: *no* taking the driver binaries apart, etc. only observe their behavior from the outside.
<DarkShadow4444>
chrisf: I know, I'm talking about an unknown binary data format. Run through compiler and compare output, nothing more.
<chrisf>
:+1:
g3rp has left #asahi-gpu [#asahi-gpu]
<morelightning[m]>
Hmm, the dump_mappings() function keeps crashing when it gets to submit command buffers.
g3rp has joined #asahi-gpu
<chrisf>
morelightning[m]: simpler example, or dig into why it doesnt work
<chrisf>
morelightning[m]: it works with the MetalComputeBasic sample
<chrisf>
morelightning[m]: and with at least one trivial drawing sample
<morelightning[m]>
Is MetalComputeBasic still around on the internet? I definitely remember it, but it seems completed erased.
TheJollyRoger has quit [Ping timeout: 268 seconds]
TheJollyRoger has joined #asahi-gpu
<morelightning[m]>
Ah that worked, though the simple triangle samples don't.
<chrisf>
morelightning[m]: figure out why :)
<morelightning[m]>
Well the file handle goes null, and I see memory allocation calls.... I am wondering if everyone has been testing without displaying to the screen?
<chrisf>
the drawing example i looked at was offscreen, yes
<chrisf>
having to interact with an IOSurface adds a lot of complexity
Baughn has quit [Ping timeout: 265 seconds]
<morelightning[m]>
It looks like, the console log still works with more complex projects if the dump mapping is taken out.
DarkShadow4444 has quit [Quit: Leaving]
mxw39 has joined #asahi-gpu
<morelightning[m]>
Actually, it's working now with the dump mappings. I don't understand it at all. Those errors were very real across 4 projects, and it's all gone now. 😅
<chrisf>
suggests we dont understand something
<chrisf>
bloom: ^
<morelightning[m]>
But is that even possible? Would the machine really going into a different state across large time spans? Or that across time, something could change in such a drastic way?
<chrisf>
stick lldb on it an see how the wrapper went wrong?
<morelightning[m]>
I probably just need to take a break. I think the default file path on the github for dump mappings () is not writable so it crashes - just a simple file write error
<chrisf>
that seems fairly benign as things going wrong go ;)
<morelightning[m]>
🤣
<morelightning[m]>
I was confused because it was mixing with the other entries in the console, and it didn't instantly occur to me that they were happening separately.
<morelightning[m]>
In anycase, I can see my own metal projects fine through it, and the commands are showing up, so this is promising.
<morelightning[m]>
I suppose, the next question, is what aspects to review first. I read some comments about memory not being fully understood.
svenpeter is now known as svenpeter1
svenpeter1 is now known as svenpeter
g3rp has left #asahi-gpu [#asahi-gpu]
JusticeEX has quit [Ping timeout: 256 seconds]
Baughn has joined #asahi-gpu
Baughn has quit [Remote host closed the connection]
Baughn has joined #asahi-gpu
<chrisf>
morelightning[m]: if you're interested in command stream side, compare what you're getting with what `demo` does
<chrisf>
possibly look at the (much simpler) command stream for compute shader only
<chrisf>
tease out the unknown things one by one
* bloom
has some notes on compute shaders from last weekend
<bloom>
The big headscratcher is cmd_*.bin
<bloom>
this has a pointer to another buffer which is quite clearly the command buffer and which I could understand well enough
<bloom>
but it also has a lot of other magic numbers, pointers to zero, etc that don't make much sense, and that got copied into `demo` verbatim
<bloom>
(Not *nearly* enough entropy to be firmware, in case anyone was wondering)